Loading story…
A critical arbitrary file read flaw tracked as CVE-2026-59774 was disclosed in Gitea and Forgejo, allowing attackers to retrieve local files from vulnerable servers through the markup rendering feature. The issue stems from unsafe handling of Org-mode #+INCLUDE directives in the go-org library, which can resolve absolute filesystem paths when the default ReadFile callback is not overridden. In Gitea, the bug was demonstrated against public repository markup rendering and was reported to affect versions 1.27.0 and 1.27.1, with proof-of-concept requests exposing files such as /etc/passwd.
Public exploit support quickly followed for both platforms. A Nuclei template was published to detect the Gitea exposure via crafted POST requests to the repository markup endpoint, while a Metasploit auxiliary module was released for Forgejo that targets POST /api/v1/markup, extracts included file contents from rendered HTML, and can save retrieved files locally. Forgejo was reported vulnerable in versions 7.0 through 15.0.5 and 16.0.0 through 16.0.1, with fixes available in 15.0.6 and 16.0.2; demonstration output showed successful reads of files including /etc/hosts.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
A Metasploit auxiliary module, auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774, was submitted to exploit CVE-2026-59774 by authenticating to Forgejo, posting crafted org-mode content to /api/v1/markup, and extracting included file contents from the HTML response. Example output showed successful reading of /etc/hosts from a Forgejo 15.0.5 target and saving the retrieved file locally.
A nuclei template named gitea-public-repo-exposure.yaml was submitted to detect CVE-2026-59774 by targeting the vulnerable Gitea markup endpoint. Validation output in the submission showed a successful match against a test instance.
A reference described CVE-2026-59774 as a critical unauthenticated arbitrary file read in Gitea 1.27.0 and 1.27.1 via the public repository markup rendering endpoint. The proof of concept used crafted Org-mode input with a #+INCLUDE directive to read local files such as /etc/passwd from the server.
CVE-2026-59774 was described as an arbitrary file read flaw in Forgejo's markup rendering API caused by the go-org library's default ReadFile callback not being overridden, allowing org-mode #+INCLUDE directives to read absolute paths on the server. The affected versions were reported as 7.0 through 15.0.5 and 16.0.0 through 16.0.1, with fixes available in 15.0.6 and 16.0.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
CISA added **CVE-2026-60004** to its Known Exploited Vulnerabilities catalog after confirming exploitation of a code-injection flaw in the Gitea self-hosted development platform. An attacker with repository write access can send a malicious patch to the `diffpatch` API, install an executable Git hook, and run shell commands under the Gitea service account. Gitea addressed the vulnerability in version **1.27.1**; CISA set an August 28 remediation deadline for U.S. federal agencies and advised affected organizations to apply vendor mitigations, assess internet exposure, and conduct relevant forensic triage. The responsible threat actors and their objectives remain unknown. CISA's preceding catalog update also added **CVE-2026-21962**, an improper access-control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. The Oracle flaw can permit unauthorized creation, deletion, modification, or access to critical data, potentially extending to all accessible product data. Organizations should prioritize patching or applying vendor mitigations for both KEV-listed vulnerabilities, and discontinue affected products where mitigations are unavailable.
Aug 28, 2026